GHSA-gr35-qcpp-65w5: Zipline before 4.6.1 Path Traversal via Imported Filenames in LocalDatasource
Zipline before 4.6.1 contains a path traversal vulnerability in LocalDatasource that allows SUPERADMIN users to read or delete files outside the upload directory by importing records with traversal filenames. Attackers can trigger the unchecked range-read path with byte-range requests or set expired deletion times to delete files accessible to the Zipline process.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
Exploitation requires SUPERADMIN privileges in Zipline. The attacker must be able to import records with traversal filenames, and exploitation also requires the stated attack preconditions of high complexity and user interaction.
Are default Zipline deployments affected?
The available information does not state whether the vulnerable LocalDatasource behavior is enabled or reachable in a default deployment. Exposure depends on use of LocalDatasource and the presence of a SUPERADMIN account capable of importing crafted records.
What can an attacker do after successful exploitation?
An attacker can read files outside the upload directory by triggering the unchecked range-read path with byte-range requests. They can also delete files accessible to the Zipline process by setting expired deletion times.
What should be done if upgrading is not immediately possible?
Restrict SUPERADMIN access to trusted administrators and prevent untrusted users from supplying imported record filenames. Limit the Zipline process account's filesystem permissions so it cannot read or delete sensitive files outside the upload directory.
How can I determine whether my deployment is affected?
Deployments running a Zipline version before 4.6.1 are affected if LocalDatasource is used and a SUPERADMIN can import records with attacker-controlled filenames. Review imported records and related requests for traversal-style filenames, byte-range requests, or expired deletion times targeting files outside the upload directory.